blackteay/gin
3
0
Fork 0
mirror of https://github.com/gin-gonic/gin.git synced 2025-10-17 22:32:26 +08:00
Code Issues Projects Releases Wiki Activity

basic auth: fix timing oracle

Browse Source
This commit is contained in:
Vladislav Yarmak 2021-01-12 16:07:24 +02:00
parent f4bc259de3
commit 883f03262f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
auth.go
View File

@ -5,6 +5,7 @@
package gin
import (
"crypto/subtle"
"encoding/base64"
"net/http"
"strconv"
@ -30,7 +31,7 @@ func (a authPairs) searchCredential(authValue string) (string, bool) {
return "", false
}
for _, pair := range a {
if pair.value == authValue {
if subtle.ConstantTimeCompare([]byte(pair.value), []byte(authValue)) == 1 {
return pair.user, true
}
}